Resolving Siemens CP 341 Modbus Master LADDR Hex Address Fault

Problem Overview

The Siemens CP 341 communication processor is one of the most widely deployed point-to-point serial modules for the S7-300 and ET 200S families. When the CP 341 is configured as a Modbus RTU master using the licensed MODB_341 driver dongle, the module is expected to issue a request frame on FB 7 / FB 8 (or the parameter-driven instance of the MODB_341 function block) call, return a status word, and read the slave response on the next call.

The most commonly reported failure mode in fresh projects is a silent no-transmit condition:

• The STATUS output word of the loadable Modbus function block returns 0 or the DONE/ERROR bits never toggle.
• The yellow Tx LED on the front of the CP 341 never lights up, even though the program is calling the master block cyclically.
• The Rx LED also stays dark because the slave never receives a valid frame to answer.
• STEP 7 reports no diagnostic buffer entry on the CP 341 because no malformed frame was ever attempted to be transmitted.

This symptom is almost always caused by a single configuration mistake: the logical base address (LADDR) passed into the MODB_341 function block is being typed in decimal in the instance DB or in the call interface, while STEP 7 / the CP 341 firmware expects the address exactly as it appears in the HW Config table — in hexadecimal.

Affected CP 341 Variants and Part Numbers

All three CP 341 production variants use the same MODB_341 instruction set and the same LADDR convention. The interface type only affects the cable, pinout, and maximum baud rate.

The RS422/485 variant (1CH02) is by far the most common in Modbus RTU master applications because it supports multi-drop on a single shielded twisted pair. All diagnostics in this article apply to this variant unless otherwise stated.

MODB_341 Driver and Instruction

The MODB_341 instruction is a loadable driver — not a block that ships with STEP 7. It must be installed on the programming PC and licensed with the hardware USB dongle.

Key facts:

• Driver package (master): 6ES7870-1AA01-0YA0 — S7 driver for CP 341 Modbus Master (RS232/RS422/485). Refer to the Siemens product entry for 6ES7870-1AA01-0YA0.
• Function blocks provided: Master sends (FB 7 P_SND_RK wrapper, plus the Modbus master wrapper FB 80 / FB 81 family or the MODB_341 block as installed by the driver) and master receives.
• Companion slave driver: MODB_341 for Modbus slave — documented at Siemens TIA docs: MODB_341 Modbus Slave instruction for CP 341. The slave instruction shares the same LADDR convention.
• Licensing: The driver dongle is checked at function-call time. If the dongle is missing, the function block returns the status W#16#8x7F range; the CP 341 Tx LED still stays dark because the request never reaches the module.

When you install the driver, the package deposits the following in the STEP 7 libraries:

MODB_341  (FB)  - master call (read/write coils/registers)
MODB_341  (FC)  - parameter init helper (load protocol parameters)
MODB_341  (UDT) - parameter structure (baud, parity, slave ID, retries)

The parameter LADDR on the master call must match the start address of the input address area of the CP 341 as shown in the HW Config "Addresses" tab.

Root Cause: LADDR Encoding (Hexadecimal vs Decimal)

The CP 341 occupies 16 bytes (8 input words and 8 output words) or 32 bytes of the S7-300 backplane I/O area, depending on the configured address area. STEP 7 always prints the Input / Output start addresses in hexadecimal in HW Config.

Typical CP 341 (1CH02-0AE0) factory address in slot 4 of an S7-300 rack:

• Input start: 384 decimal = 180 hex (i.e., W#16#0180)
• Output start: 384 decimal = 180 hex (some firmware revisions show input/output as separate, e.g. 0..15 and 0..15)

Common S7-300 slot 6 placement:

• Input start: 288 dec = 120 hex

The mistake that produces the silent-no-transmit symptom is to copy the decimal value 384 (or 288) directly into the LADDR input of the MODB_341 call. Internally the block calls the CP 341 with address W#16#0384 (= 900 dec), which falls outside the backplane I/O area assigned to the CP. The firmware reports nothing — there is no slave, no frame, and no error — because the read into the module's status word simply returns the backplane's default 0.

The correct value for LADDR in the above examples is W#16#0180 (384 dec) or W#16#0120 (288 dec) — i.e., the hexadecimal number that appears in the HW Config "Addresses" column.

Diagnostic Procedure — CP 341 LED Behavior

Before opening the program, observe the four front-panel indicators of the CP 341. The LED pattern is the fastest root-cause discriminator.

If SF is off and Tx never blinks when the master block is called cyclically, the most likely causes, in order of frequency, are:

1. LADDR entered in decimal (this article's main subject).
2. No protocol parameters loaded — the FC MODB_341 parameter-init call was never made or its DONE bit was not awaited.
3. The CP 341 was placed in the hardware catalog with an unconfigured "PtP" protocol — the Modbus master protocol must be explicitly assigned and downloaded to the module via HW Config → CP 341 → Properties → Protocol.
4. Dongle missing — the block returns STATUS = W#16#8x7F; check STATUS in the instance DB.
5. Hardware wiring — for RS422/485, missing terminator, swapped A/B, or no common reference ground. Tx will not blink if the line driver cannot see the bus.

Step-by-Step Resolution

Execute the following procedure in order. Stop at the first step that resolves the issue and document the root cause in your commissioning log.

Step 1 — Verify the logical base address in HW Config

1. Open the SIMATIC Manager project.
2. Open HW Config.
3. Double-click the CP 341 module in the rack.
4. Switch to the "Addresses" tab.
5. Note the Input start address. The value is displayed in hexadecimal, e.g. 180 (which equals 384 decimal). This is the value that must be written to LADDR.

Example capture from HW Config (Addresses tab, CP 341 in slot 6):

Input:   288 ... 303   (start = 288 dec = 120 hex)
Output:  288 ... 303   (start = 288 dec = 120 hex)

For this configuration, LADDR := W#16#0120.

Step 2 — Convert decimal to hexadecimal for LADDR

The most common conversions in S7-300 default slot assignments:

Use the Windows Calculator in Programmer mode (View → Programmer) to convert: enter decimal, click Hex, the display shows the same logical address as a hex word.

Step 3 — Update the LADDR input on the MODB_341 call

Open the OB1 (or cyclic OB) that contains the master call. In the instance DB of the MODB_341 FB, locate the LADDR input parameter. Replace the decimal literal with the hexadecimal WORD constant.

Before (incorrect — silent no-transmit):

CALL  "MODB_341" , DB_ModbusMaster
  LADDR  := 384            // WRONG — decimal 384 = W#16#0180, but
                          // STEP 7 stores 384 as W#16#0384 (=900)
  START  := TRUE
  INIT   := FALSE
  ...
  STATUS := MW100

After (correct):

CALL  "MODB_341" , DB_ModbusMaster
  LADDR  := W#16#0180     // matches HW Config start address
  START  := TRUE
  INIT   := FALSE
  ...
  STATUS := MW100

If you cannot enter the W#16# prefix in a particular editor, enter the hex value without the prefix in a temporary data word first, e.g.:

L  W#16#0180
T  LW 0                  // LADDR source word
CALL "MODB_341", DB_ModbusMaster
  LADDR := LW0

Step 4 — Recompile and download

1. Save and recompile the S7 program.
2. Download the program blocks to the CPU (target system → download).
3. If the protocol selection in HW Config has not been changed, skip to step 5. If you changed the protocol assignment (PtP → Modbus Master), you must re-download HW Config to the CPU. STEP 7 will prompt; confirm.
4. Switch the CPU from STOP to RUN.

Step 5 — Observe Tx LED

With the corrected LADDR, the yellow Tx LED on the CP 341 front panel must blink on each call of the master FB. If the LED is still dark, proceed to step 6.

Step 6 — Verify the protocol parameters are loaded

The Modbus master driver does not retain parameters across power-cycle unless the parameter-init FC is run during startup. Confirm that OB100 (or the first scan of OB1) calls the parameter init block:

CALL "MODB_INIT"
  LADDR := W#16#0180     // SAME hex value as the master call
  BAUD  := B#16#07       // 19200 bit/s (see baud table)
  PARITY := B#16#02      // even
  DATABITS := 8
  STOPBITS := 1
  DONE  := M10.0
  ERROR := M10.1
  STATUS := MW102

If INIT is never pulsed or DONE is never set, the CP 341 has no loaded protocol and will silently drop all requests.

Step 7 — Verify the dongle

Insert the license USB dongle on the programming PC during the parameter init and master calls (the dongle is checked by the driver at runtime). A missing dongle produces STATUS = W#16#8x7F; with no LADDR error, this is a positive sign that the LADDR is now correct.

Hardware Configuration: Finding the Hex Address Programmatically

If you cannot open HW Config (for example, on a remote site or a backup project), the logical base address can be read from the CPU by reading system status lists (SSL) with SFC 51. A practical snippet to display the CP 341 base address in a VAT:

CALL "RD_LGADR"          // user FB or SFC 51 wrapper
  IOID    := B#16#54     // output/input mix
  LADDR   := W#16#0180   // candidate base address
  RET_VAL := MW200
  BUSY    := M20.0
  ...
  IO_BASE := MW202       // returns logical base as hex WORD
  IO_LEN  := MW204       // length in bytes

Compare the returned IO_BASE with the value in your master call — they must match exactly. The returned value is always a hex word.

Cable and Pinout Verification (RS422/485, 1CH02-0AE0)

Once LADDR is correct and the Tx LED blinks, focus moves to the physical layer. The CP 341 RS422/485 uses the 15-pin sub-D female X27 connector on the front panel.

For 2-wire RS485 Modbus, terminate the bus with 120 Ω between pins 8 and 9 at each physical end. On the CP 341, the internal termination is not enabled by default; it must be set on the cable connector or by an external terminator.

Communication Parameter Configuration

Match all six Modbus RTU parameters between the CP 341 (set in HW Config → CP 341 → Properties → Protocol → Modbus Master) and the slave:

Verification and Commissioning Tests

After applying the corrected LADDR, perform the following three tests before declaring the link healthy.

Test 1 — Static STATUS inspection

Insert a VAT watch on the instance DB LADDR, STATUS, DONE, and ERROR fields. Run the master block once. Expected values:

• STATUS = 0 while the call is in progress (the block polls).
• STATUS = W#16#0000 and DONE = TRUE on successful read.
• STATUS = W#16#0F01 to 0Fxx family on a slave-level error (timeout, CRC, exception).
• STATUS = W#16#8xxx family on a driver-level error (dongle, parameter, internal).

Test 2 — Oscilloscope on the bus

Place a differential probe across pins 8 and 9 of the X27 connector (RS485 2-wire). Each master call must produce one complete Modbus RTU frame: address byte, function code, payload, CRC low, CRC high. Frame length and byte timing must be visible.

Test 3 — Slave response verification

With the bus quiet, the Rx LED must blink in response to the Tx LED within the configured response timeout (default 2000 ms in the driver). If Tx blinks but Rx stays dark, the slave is not answering — check slave address, baud, parity, and termination. If both LEDs blink but the driver returns W#16#0F03 (CRC error), the bus has noise or a bad ground reference.

Troubleshooting Matrix

Why the Driver Does Not Flag a Wrong LADDR

The MODB_341 driver writes the request into the CP 341's input area and reads the response from its output area. Both reads and writes use the S7-300 backplane P-bus, which does not reject writes to unused slot address space. The driver therefore has no way to distinguish "I just wrote into a slot that has no module" from "the module is busy." The CP 341 firmware only checks the address when a real frame is being assembled — and if the driver never issued a frame, no error is ever raised.

This is the technical reason the silent-no-transmit symptom is so easy to overlook: every check in the diagnostic buffer, every LED, and every STATUS word reports a healthy system. The address discrepancy lives only in the discrepancy between the human-readable number in the code (384 dec) and the hex value the firmware needs (180 hex).

Related Parameters Worth Checking

After correcting LADDR, validate the following during the same commissioning session to prevent a second call-out:

• RET_VAL of the parameter init FC — must be 0 after DONE.
• Response timeout in the protocol dialog — default 2000 ms is suitable for ≤19200 bit/s; drop to 500 ms for 115200 bit/s.
• Pause between requests — set to ≥3.5 character times for Modbus RTU compliance; the driver normally inserts this automatically.
• Number of retries — 2 is typical for noisy industrial environments; 0 disables retries and exposes transient bus errors.
• Hardware flow control — disabled for Modbus RTU on RS485; the bus is half-duplex and the line driver handles direction.

FAQ